Fortinet Fortinet Certifications NSE7_EFW-6.0 Questions & Answers

• Question 1:

  View the following FortiGate configuration.

  

  All traffic to the Internet currently egresses from port1. The exhibit shows partial session information for Internet traffic from a user on the internal network.

  

  If the priority on route ID 1 were changed from 5 to 20, what would happen to traffic matching that user's session?

  A. The session would be deleted, so the client would need to start a new session.

  B. The session would remain in the session table, and its traffic would still egress from port1.

  C. The session would remain in the session table, and its traffic would start to egress from port2.

  D. The session would remain in the session table, but its traffic would now egress from both port1 and port2.

  Correct Answer: B

• Question 2:

  Which of the following statements about bulk configuration changes using FortiManager CLI scripts are correct? (Choose two.)

  A. When executed on the All FortiGate in ADOM, changes are automatically installed without creating a new revision history.

  B. When executed on the Remote FortiGate directly, administrators do not have the option to review the changes prior to installation.

  C. When executed on the Device Database, you must use the installation wizard to apply the changes to the managed FortiGate.

  D. When executed on the Policy Package, ADOM database, changes are applied directly to the managed FortiGate.

  Correct Answer: BC

• Question 3:

  View these partial outputs from two routing debug commands:

  

  Which outbound interface will FortiGate use to route web traffic from internal users to the Internet?

  A. Both port1 and port2

  B. port3

  C. port2

  D. port1

  Correct Answer: A

• Question 4:

  An administrator wants to capture ESP traffic between two FortiGates using the built-in sniffer. If the administrator knows that there is no NAT device located between both FortiGates, what command should the administrator execute?

  A. diagnose sniffer packet any 'esp'

  B. diagnose sniffer packet any 'tcp port 500 or tcp port 4500'

  C. diagnose sniffer packet any 'udp port 4500'

  D. diagnose sniffer packet any 'udp port 500'

  Correct Answer: A

• Question 5:

  View the exhibit, which contains a partial output of an IKE real-time debug, and then answer the question below.

  

  Based on the debug output, which phase-1 setting is enabled in the configuration of this VPN?

  A. auto-discovery-receiver

  B. auto-discovery-forwarder

  C. auto-discovery-sender

  D. auto-discovery-shortcut

  Correct Answer: A

• Question 6:

  What is the purpose of an internal segmentation firewall (ISFW)?

  A. It is the first line of defense at the network perimeter.

  B. It inspects incoming traffic to protect services in the corporate DMZ.

  C. It is an all-in-one security appliance that is placed at remote sites to extend the enterprise network.

  D. It splits the network into multiple security segments to minimize the impact of breaches.

  Correct Answer: D

• Question 7:

  View the exhibit, which contains the partial output of an IKE real-time debug, and then answer the question below.

  

  Which of the following statements about this debug output are correct? (Choose two.)

  A. It shows a phase 1 negotiation.

  B. The initiator has provided remote as its IPsec peer ID.

  C. The negotiation is using AES128 encryption with CBC hash.

  D. The remote gateway IP address is 10.0.0.1.

  Correct Answer: AB

• Question 8:

  Which of the following statements are correct regarding application layer test commands? (Choose two.)

  A. Some of them display statistics and configuration information about a feature or process.

  B. They are used to filter real-time debugs.

  C. They display real-time application debugs.

  D. Some of them can be used to restart an application.

  Correct Answer: AD

• Question 9:

  What configuration settings change the behavior for content-inspected traffic while FortiGate is in conserve mode? (Choose two.)

  A. mem-failopen

  B. ips-failopen

  C. utm-failopen

  D. av-failopen

  Correct Answer: BD

• Question 10:

  What does the dirty flag mean in a FortiGate session?

  A. The session must be removed from the former primary unit after an HA failover.

  B. Traffic has been identified as from an application that is not allowed.

  C. The next packet must be re-evaluated against the firewall policies.

  D. Traffic has been blocked by the antivirus inspection.

  Correct Answer: C